Release 2.58 (#5952)
* bump version * fix formatting locale reset after embedded controller sub-requests (#5944) * fix GHSA-c6w6-57jj-62vh * fix GHSA-m492-gv72-xvxj * fix GHSA-jr9p-4h4j-6c58 * make sure to only use JS logic to call API endpoints * fixes GHSA-r8vr-m544-qh4h * make sure to only use JS logic to call API endpoints * fix GHSA-rw46-qg69-vg6h * fix GHSA-pj8j-p4g4-4vw8 - prevent kimai from rendering images via markdown * fix GHSA-pj8j-p4g4-4vw8 - use a safe network client to prevent SSRF via images * fix GHSA-xv4r-4885-gwpg * fix GHSA-pgcc-vfmc-7cw5 - move GET routes to API with POST method to prevent CSRF * fix tooltip survives page reload * updated wizard images * split wizard and password reset subscriber into two classes * relax upper php limit * added zizmor workflow scans and apply findings * user permissions <name>_other_profile now respect teams * move all linting steps to new job * updated docker image version names * use .env.local for storing APP_SECRET * improve build order and use given tag as ref for checkout, not default main branch * improved APP_SECRET handling, see entrypoint.sh * use local code for building the image for more flexibility, added dockerignore
This commit is contained in:
Kevin Papst
@@ -10,31 +10,152 @@
|
||||
namespace App\Tests\EventSubscriber;
|
||||
|
||||
use App\Configuration\LocaleService;
|
||||
use App\Entity\User;
|
||||
use App\EventSubscriber\RedirectToLocaleSubscriber;
|
||||
use PHPUnit\Framework\Attributes\CoversClass;
|
||||
use PHPUnit\Framework\TestCase;
|
||||
use Symfony\Component\HttpFoundation\RedirectResponse;
|
||||
use Symfony\Component\HttpFoundation\Request;
|
||||
use Symfony\Component\HttpKernel\Event\RequestEvent;
|
||||
use Symfony\Component\HttpKernel\HttpKernelInterface;
|
||||
use Symfony\Component\HttpKernel\KernelEvents;
|
||||
use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
|
||||
use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
|
||||
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
|
||||
|
||||
#[CoversClass(RedirectToLocaleSubscriber::class)]
|
||||
class RedirectToLocaleSubscriberTest extends TestCase
|
||||
{
|
||||
public function testConstruct(): void
|
||||
public function testGetSubscribedEvents(): void
|
||||
{
|
||||
self::assertEquals([KernelEvents::REQUEST => ['onKernelRequest', 0]], RedirectToLocaleSubscriber::getSubscribedEvents());
|
||||
}
|
||||
|
||||
public function testOnKernelRequestIgnoresNonHomepageRequest(): void
|
||||
{
|
||||
$storage = $this->createMock(TokenStorageInterface::class);
|
||||
$storage->expects($this->never())->method('getToken');
|
||||
|
||||
$urlGenerator = $this->createMock(UrlGeneratorInterface::class);
|
||||
$sut = new RedirectToLocaleSubscriber($urlGenerator, new LocaleService(['de' => LocaleService::DEFAULT_SETTINGS, 'en' => LocaleService::DEFAULT_SETTINGS]));
|
||||
$urlGenerator->expects($this->never())->method('generate');
|
||||
|
||||
self::assertEquals([KernelEvents::REQUEST => ['onKernelRequest']], RedirectToLocaleSubscriber::getSubscribedEvents());
|
||||
|
||||
$request = $this->createMock(Request::class);
|
||||
$request->expects($this->once())->method('getPathInfo')->willReturn('/de');
|
||||
|
||||
$event = $this->createMock(RequestEvent::class);
|
||||
$event->expects($this->once())->method('getRequest')->willReturn($request);
|
||||
$event->expects($this->never())->method('setResponse');
|
||||
$sut = new RedirectToLocaleSubscriber($urlGenerator, $this->createLocaleService(), $storage);
|
||||
$event = $this->createRequestEvent('/de');
|
||||
|
||||
$sut->onKernelRequest($event);
|
||||
|
||||
self::assertNull($event->getResponse());
|
||||
}
|
||||
|
||||
public function testOnKernelRequestIgnoresHomepageWithSameHostReferer(): void
|
||||
{
|
||||
$storage = $this->createMock(TokenStorageInterface::class);
|
||||
$storage->expects($this->never())->method('getToken');
|
||||
|
||||
$urlGenerator = $this->createMock(UrlGeneratorInterface::class);
|
||||
$urlGenerator->expects($this->never())->method('generate');
|
||||
|
||||
$sut = new RedirectToLocaleSubscriber($urlGenerator, $this->createLocaleService(), $storage);
|
||||
$event = $this->createRequestEvent('/', ['referer' => 'https://www.kimai.test/de/dashboard']);
|
||||
|
||||
$sut->onKernelRequest($event);
|
||||
|
||||
self::assertNull($event->getResponse());
|
||||
}
|
||||
|
||||
public function testOnKernelRequestRedirectsAuthenticatedUserToLanguage(): void
|
||||
{
|
||||
$user = new User();
|
||||
$user->setLanguage('fr');
|
||||
|
||||
$token = $this->createMock(TokenInterface::class);
|
||||
$token->expects($this->once())->method('getUser')->willReturn($user);
|
||||
|
||||
$storage = $this->createMock(TokenStorageInterface::class);
|
||||
$storage->expects($this->once())->method('getToken')->willReturn($token);
|
||||
|
||||
$urlGenerator = $this->createMock(UrlGeneratorInterface::class);
|
||||
$urlGenerator
|
||||
->expects($this->once())
|
||||
->method('generate')
|
||||
->with('homepage', ['_locale' => 'fr'])
|
||||
->willReturn('/fr');
|
||||
|
||||
$sut = new RedirectToLocaleSubscriber($urlGenerator, $this->createLocaleService(), $storage);
|
||||
$event = $this->createRequestEvent('/');
|
||||
|
||||
$sut->onKernelRequest($event);
|
||||
|
||||
$response = $event->getResponse();
|
||||
self::assertInstanceOf(RedirectResponse::class, $response);
|
||||
self::assertSame('/fr', $response->headers->get('Location'));
|
||||
}
|
||||
|
||||
public function testOnKernelRequestRedirectsAnonymousUserToPreferredBrowserLanguage(): void
|
||||
{
|
||||
$storage = $this->createMock(TokenStorageInterface::class);
|
||||
$storage->expects($this->once())->method('getToken')->willReturn(null);
|
||||
|
||||
$urlGenerator = $this->createMock(UrlGeneratorInterface::class);
|
||||
$urlGenerator
|
||||
->expects($this->once())
|
||||
->method('generate')
|
||||
->with('homepage', ['_locale' => 'de'])
|
||||
->willReturn('/de');
|
||||
|
||||
$sut = new RedirectToLocaleSubscriber($urlGenerator, $this->createLocaleService(), $storage);
|
||||
$event = $this->createRequestEvent('/', ['Accept-Language' => 'de-DE,de;q=0.9,en;q=0.8']);
|
||||
|
||||
$sut->onKernelRequest($event);
|
||||
|
||||
$response = $event->getResponse();
|
||||
self::assertInstanceOf(RedirectResponse::class, $response);
|
||||
self::assertSame('/de', $response->headers->get('Location'));
|
||||
}
|
||||
|
||||
public function testOnKernelRequestFallsBackToDefaultLocaleForAnonymousUser(): void
|
||||
{
|
||||
$storage = $this->createMock(TokenStorageInterface::class);
|
||||
$storage->expects($this->once())->method('getToken')->willReturn(null);
|
||||
|
||||
$urlGenerator = $this->createMock(UrlGeneratorInterface::class);
|
||||
$urlGenerator
|
||||
->expects($this->once())
|
||||
->method('generate')
|
||||
->with('homepage', ['_locale' => 'en'])
|
||||
->willReturn('/en');
|
||||
|
||||
$sut = new RedirectToLocaleSubscriber($urlGenerator, $this->createLocaleService(), $storage);
|
||||
$event = $this->createRequestEvent('/', ['Accept-Language' => 'es-ES,es;q=0.9']);
|
||||
|
||||
$sut->onKernelRequest($event);
|
||||
|
||||
$response = $event->getResponse();
|
||||
self::assertInstanceOf(RedirectResponse::class, $response);
|
||||
self::assertSame('/en', $response->headers->get('Location'));
|
||||
}
|
||||
|
||||
private function createLocaleService(): LocaleService
|
||||
{
|
||||
return new LocaleService([
|
||||
'de' => [...LocaleService::DEFAULT_SETTINGS, 'translation' => true],
|
||||
'en' => [...LocaleService::DEFAULT_SETTINGS, 'translation' => true],
|
||||
'fr' => [...LocaleService::DEFAULT_SETTINGS, 'translation' => true],
|
||||
]);
|
||||
}
|
||||
|
||||
/**
|
||||
* @param array<string, string> $headers
|
||||
*/
|
||||
private function createRequestEvent(string $uri, array $headers = []): RequestEvent
|
||||
{
|
||||
$kernel = $this->createMock(HttpKernelInterface::class);
|
||||
$request = Request::create($uri, 'GET', [], [], [], ['HTTP_HOST' => 'www.kimai.test', 'HTTPS' => 'on']);
|
||||
|
||||
foreach ($headers as $name => $value) {
|
||||
$request->headers->set($name, $value);
|
||||
}
|
||||
|
||||
return new RequestEvent($kernel, $request, HttpKernelInterface::MAIN_REQUEST);
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user